Several years ago, the U.S. Securities and Exchange Commission (SEC) issued an order against a public company that raised more than a few eyebrows. In that order, the company settled to violations of Section 13(b)(2)(B) of the Exchange Act, typically known as the "internal accounting controls" provision. But the order did not allege anything about the company's accounting or disclosures was improper. Instead, the SEC's order found that the company purportedly failed to provide sufficient controls about its stock repurchase plan such that the company engaged in such transactions without properly evaluating whether the company was in possession of material, nonpublic information. The SEC did not charge the company with insider trading violations. The company paid $20 million to settle the matter. The order raised the ire of two dissenting commissioners, who described Section 13(b)(2)(B) as "not the appropriate tool" in this context, and ignited a significant debate amongst securities practitioners as to the proper scope of the internal accounting controls provision.

Now, a little more than three years later, the SEC issued a similar order based on a similar theory under Section 13(b)(2)(B) against one of the country's largest broadband connectivity and cable operators. This order has reignited the debate over the scope of the internal accounting controls provision in SEC enforcement actions. This blog post provides an overview of the case, an analysis of some of the SEC's sources referenced in the order and a few key takeaways.

Overview of Section 13(b)(2)(B) and the Recent Enforcement Action

Like many public companies, the telecommunications provider engaged in a series of stock buybacks dating back to September 2016. In connection with more than $70 billion in stock buybacks during this period, the company received authorization from the company's board of directors to execute these buybacks within certain parameters, including through the use of trading plans that confirmed with Exchange Act Rule 10b5-1 for stock repurchases during certain closed trading windows.

According to the SEC's order, between 2017 and 2021, nine of the company's trading plans allegedly did not comply with Rule 10b5-1 due to certain "accordion" provisions, whereby the amount of share repurchases under the plans would increase if the company engaged in certain debt offerings, offering flexibility to increase its share repurchases as new funds became available. This discretionary element resulted in a lack of compliance with Rule 10b5-1.¹ During this window, the SEC alleges that the company repurchased nearly $15 billion of shares under these trading plans.

Although the SEC acknowledged the company had implemented "controls designed to obtain share repurchase authorization from the Board, to stay within the Board's financial parameters and guidelines, and to confirm that its buyback transactions were accurately reflects in its accounts and ledgers," (Order, the SEC's order found that the company lacked controls to analyze the discretionary element of the plans and whether this complied with Rule 10b5-1.

Therefore, according to the SEC, because the board authorization was limited to share repurchases pursuant to 10b5-1 compliant trading programs, the company repeatedly traded under the allegedly deficient plans, and the company allegedly "did not have reasonably designed policies or procedures for analyzing whether the accordion provisions comported with Rule 10b5-1," the SEC's order found that the company violated internal accounting controls provision. (Order, ¶ 13)

There are four prongs of the internal accounting controls provision concerning the "system of internal accounting controls sufficient to provide reasonable assurances that —

1. Transactions are executed in accordance with management's general or specific authorization;
2. Transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets;
3. Access to assets is permitted only in accordance with management's general or specific authorization; and
4. The recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences…"

15 U.S.C. § 78m(b)(2)(B)²

The SEC's order emphasizes that the company's alleged issues were focused on transactions being executed without proper general or specific authorization. (Order, ¶¶ 5, 15)

Commission's Cited Authority Suggests a More Narrow Scope of 13(b)(2)(B)

As is often the case with SEC cases filed as settled (particularly administrative orders), practitioners have little visibility into the back-and-forth on what led to parameters of the negotiated resolution and can only go off the limited information from the order. However, there are a few breadcrumbs to suggest that the SEC's limited cited authority for support of this action is misplaced.

The SEC quoted the adopting release for Exchange Act Rules 13b2-1 and 13b2-2 (the Adopting Release)³ to note that "[i]t bears emphasis that the accounting provisions of the FCPA are not exclusively concerned with the preparation of financial statements. An equally important objective of the new law…is the goal of corporate accountability." ⁴ A reading of the Adopting Release reinforces that Section 13(b)(2)(B) can provide an independent basis for enforcement "whether or not violation of the provisions may lead, in a particular case, to the dissemination of materially false or misleading information to investors." Furthermore, a review of a second authority quoted by the agency – the SEC's policy regarding the Foreign Corrupt Practices Act of 1977 (FCPA), as set forth in an address by then-SEC Chair Harold M. Williams entitled "The Accounting Provisions of the Foreign Corrupt Practices Act: An Analysis," (the Policy Statement) – does include multiple references to ensuring that transactions conform to management's authorization.⁵

However, the SEC's single quotations from the Adopting Release and Policy Statement omit the broader context of such documents. As detailed below, a more fulsome analysis of the Adopting Release and Policy Statement suggest a narrower approach than the approach advanced by the SEC in the matter discussed herein.

Adopting Release

The stated purpose of the Adopting Release – titled "Promotion of the Reliability of Financial Information and Prevention of the Concealment of Questionable or Illegal Corporate Payments and Practices" – is to ensure the accurate and fair reflection of transactions and disposition of assets by an issuer. Although there may be a question of whether the company complied with certain regulatory requirements, there is nothing in the order to suggest that the company's accounting records, e.g., its books or transactions, were not accurately reflected.

Although Section 13(b)(2)(B) includes two subparts concerning transactions and access to assets being limited to those "in accordance with management's general or specific authorization," the thrust of this rule appears to tie back to one of the threshold issues in the Adopting Release's summary: "to prevent the concealment of questionable or illegal corporate payments and practices."⁶ This ties into the repeated references in the Adopting Release about "off-the-books slush funds" and "concealed corporate payments," along with concerns about "improper corporate payments and practices [ ] rarely reflected in corporate books, records, and accounts in an accurate manner…" Sources referenced by the SEC in the Adopting Release address concerns focused on corporate disclosure and concerns about "widespread corporate bribery" such as "the proper accounting of the use of corporate funds and that documents filed with the Commission and circulated to shareholders…"⁷ Again, none of these issues appear to be at play in this matter.

Moreover, the SEC's quoted reference to "corporate accountability" seems to be taken out of the original context. Outside of the quote, there are only two other references in the Adopting Release concerning "corporate accountability," and both come from the SEC's "May 12 Report," a 1976 Commission Report concerning questionable and illegal corporate payments and practices. As detailed below, both references are focused on more narrow aspects of proper accounting and accurate representations to shareholders:

The almost universal characteristic of the cases has been the apparent frustration of our system of corporate accountability which has been designed to assure that there is proper accounting for the use of corporate funds and that documents filed with the Commission and circulated to shareholders do not omit or misrepresent material facts.

In this context the new Rule is primarily intended to help restore the efficacy of the system of corporate accountability and to encourage boards of directors to exercise their authority to deal with the problem.

As such, any reference to "corporate accountability" within the Adopting Release is seemingly moored to the concept around proper accounting for the use of corporate funds and information disseminated to shareholders. Based on a review of the order, neither issue is apparent here.

Policy Statement

The SEC's order also includes a reference to the Policy Statement. (Order, ¶ 15, n. 4) Again, the quoted statement misses the broader context. Then-SEC Chair Williams noted that the issuance of the Policy Statement (id. at 1) was due in large part to concerns raised about the accounting provisions after the passage of the FCPA:

consternation can be attributed, in significant part, to the spectre which some commentators have raised of exposure to Commission enforcement action, and perhaps criminal liability, as a result of technical and insignificant errors in corporate records or weaknesses in corporate internal accounting controls. In fact, some commentators claim that, because of the broad strokes with which the accounting provisions are fashioned, no corporate executive can ever feel fully confident that his corporation is in compliance with the law. And, other commentators have expressed fear that this lack of concrete statutory parameters evidences a meaning to the Act which is far beyond its Congressional intent.

The Policy Statement continued that, at that time, "the Commission has not sought out violations of the accounting provisions for their own sake; indeed, we have not chosen to bring a single case under these provisions that did not also involve other violations of law." Id. at 3 (emphasis added). Furthermore, the Policy Statement provides contextual background to the accounting provisions, highlighting the background of not only illegal or questionable payments but also falsified records (the justification for the implementation of Exchange Act Rule 13b2-1).

As for the quoted language in the order, the broader context of the Policy Statement (id. at 7) reveals a far less aggressive enforcement viewpoint concerning the internal accounting controls provision:

Turning to the controls question, there is an almost infinite variety of control devices which could be utilized in a particular business environment. Thus, considerable deference properly should be afforded to the company's reasonable business judgments in this area. The purpose of the internal accounting control provisions, after all, is to assure that a public company adopts accepted methods of recording economic events, safe-guarding assets, and conforming transactions to management's authorization. Importantly, the selection and implementation of particular control procedures, so long as they are reasonable under the circumstances, remain management prerogatives and responsibilities.

In this vein, the law long ago determined that it should avoid interfering in reasonable corporate decisionmaking which entails the exercise of good faith judgment concerning routine matters. High societal costs—including lost innovation and vexatious litigation—would result if courts could substitute their judgments for those of business executives concerning such matters. Provided that the reasonable assurances requirement set forth in the statute is met, the Act's accounting provisions, relating as they do to matters of internal corporate conduct and management, justify such deference to decisions regarding corporate records and control mechanisms; certainly nothing in the Act mandates a different standard of review.

This concept is not a mandate for board—or even most senior management— involvement in the minutia of recording and accounting for every transaction which the company may make. But, it does mean that both management and the board have important roles to play in monitoring and evaluating the adequacy of the company's records and controls systems.

This standard is not satisfied if a company's leadership, while making nominal gestures of compliance, abdicates its responsibilities to foster integrity among those who operate the system. Regardless of how technically sound an issuer's controls are, or how impressive they appear on paper, it is unlikely that control objectives will be met in the absence of a supportive environment. In the last analysis, the key to an adequate "control environment" is an approach on the part of the board and top management which makes clear what is expected, and that conformity to these expectations will be rewarded while breaches will be punished.

quoted language from the order

Accordingly, a more fulsome reading of the sources referenced in the order suggests that compliance with certain regulatory requirements – such as compliance with Rule 10b5-1 trading plans – do not appear to be the type of internal accounting controls contemplated within the scope of Section 13(b)(2)(B).

SEC Commissioners' Dissent Raises Old Concerns

SEC Commissioners Hester Peirce and Mark Uyeda dissented from the SEC's decision (the Dissent). Among other critiques, Commissioners Peirce and Uyeda harped on the SEC's "unmooring of Section 13(b)(2)(B) from its statutory test and context to extend the reach of its jurisdiction." The commissioners decried the SEC's "failure to distinguish between internal accounting controls and other types of internal controls." The Dissent was more abbreviated than the dissent Commissioner Peirce co-authored three years earlier, although Commissioners Peirce and Uyeda cited the previous dissent in their current one. In the previous dissent, Commissioner Peirce and former Commissioner Elad Roisman raised several concerning points:

• "Since Section 13(b)(2)(B)'s enactment in 1977, the Commission has never before found that the 'internal accounting controls' required by that provision include management's assessment of a company's potential insider trading liability. This application of Section 13(b)(2)(B) exceeds its limited scope."
• Focusing on the full text of Section 13(b)(2)(B), "[b]y thinking of Section 13(b)(2)(B) as a generic 'internal controls' provision, we overlook an important limit: This provision requires not 'internal controls' but 'internal accounting controls.'"
• Referencing the Senate Report on the enactment of the FCPA, the commissioners wrote, "Under the heading 'Accurate accounting,' the report explained that '[t]he purpose' of the section of the bill including internal accounting controls was 'to strengthen the accuracy of the corporate books and records and the reliability of the audit process which constitute the foundations of our system of corporate disclosure.'"
• "[T]he precise language of Section 13(b)(2)(B) was taken from the authoritative accounting literature, namely from a Statement on Auditing Standards published by the American Institute of Certified Public Accountants. Those auditing standards further delineated the limited scope of internal accounting controls by emphasizing a distinction between 'administrative control' and 'accounting control.' The standards defined 'accounting control' as limited to the plan of organization and the procedures and records 'that are concerned with the safeguarding of assets and the reliability of financial records.' By safeguarding" assets, the standards clarified that they do not mean 'protection against something undesirable,' which 'could lead to a broad interpretation' that 'any procedures or records entering into management's decision-making processes are comprehended.' In contrast to the limited definition of accounting control, administrative control was defined in a more open-ended manner that 'includes' procedures and records 'concerned with the decision processes leading to management's authorization of transactions' and is 'directly associated with the responsibility for achieving the objectives of the organization.'"

Takeaways

The narrow takeaway from this recent enforcement order is that corporate share repurchases during closed trading windows are at the intersection of several key enforcement and rulemaking areas for the SEC: 1) the SEC recently finalized new rules concerning share repurchase disclosures (rules which were recently kicked back by the U.S. Court of Appeals for the Fifth Circuit, in part because the court did not believe the SEC had made a sufficient showing that "opportunistic or improperly motivated buybacks" constituted "genuine problems"⁸); and 2) less than a year ago, the SEC adopted amendments to Rule 10b5-1, which is an area both the SEC and U.S. Department of Justice (DOJ) have targeted for potential abuse. There is little question that these type of transactions will continue to bear the brunt of SEC enforcement scrutiny.

But the broader takeaway is more concerning. The order marks the second time that the SEC has utilized the internal accounting controls provision to seemingly "gap fill" a statutory void where it possibly 1) couldn't prove scienter, 2) did not have false or misleading disclosures or books and records, and 3) couldn't bring charges under its other controls provisions such as Exchange Act Rule 13a-15. As Commissioner Peirce and former Commissioner Roisman noted in 2020, in some general sense, nearly every corporate action involves management directing or authorizing an affirmative act, meaning that the potential uses for this type of theory are significant. While appreciating that both of the share repurchase matters were negotiated settlements, it does not take much extrapolation to see how this usage is similar to the SEC's Division of Enforcement's expanded use of disclosure controls and procedures (DCP) enforcement.

The SEConds Opinions Blog will continue to monitor SEC enforcement actions for similar internal accounting controls matters and provide updates on any notable developments.

Notes

¹ According to the SEC's order, the company: "retained continuing discretion over whether and when to complete debt offerings and trigger the accordions. Because the accordion provisions in these plans gave [the company] the ability to change the total dollar amounts available for share repurchases, and the timing of additional repurchases, [the company's] plans did not meet the conditions of Rule 10b5-1(c)(1)(i)(B)." (Order, ¶ 11).

² According to the Senate Report favorably reporting the bill, subparagraph (b)(2)(B) incorporated the definitions of the objectives with respect to internal accounting controls "from the authoritative accounting literature." S. Rep. 95-114 (1977), reprinted in 1977 U.S.C.C.A.N. 4098, 4105.

³ These rules deal with the falsification of accounting records (Exchange Act Rule 13b2-1) and representations to public company auditors (Exchange Act Rule 13b2-2). As detailed herein, the Adopting Release does include extensive discussion on the accounting provisions.

⁴ Order, ¶ 15 n. 4, citing Adopting Release, Exchange Act Rel. 34-15570, 44 Fed. Reg. 10,966.

⁵ Policy Statement, Exchange Act Rel. 34-17500.

⁶ The SEC did note that the rule was intended to deal with a "broader range of practices than the problem of

questionable or illegal corporate payments and practices" but continued to use examples focused on these issues.

⁷ See, e.g., S. Comm. On Banking, Housing, and Urban Affairs, Foreign Corrupt Practices and Domestic and Foreign Investment Improved Disclosure Acts of 1977, S. Rep. No. 95114; see also American Institute of Certified Public Accountants, Statement on Auditing Standards No. 1, 320.37 & 320.38.

⁸ See U.S. Chamber of Com. v. S.E.C., 85 F. 4th 760, 777-779 (5th Cir. 2023). The Fifth Circuit concluded that the SEC's stated overarching justification for the rules, to decrease "investor uncertainty about motivations underlying buybacks," was "inadequately substantiated." Id. at 777. The lack of substantiation rendered the rules arbitrary and capricious, in violation of the Administrative Procedures Act. See 5 U.S.C. § 706(2)(A)-(B), (D).